Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 19:25
General
-
Target
d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
-
Size
280KB
-
MD5
d2ab0dd4e841d5ae967f173cf7b84c2c
-
SHA1
96a17210f2404f0f39933c9bf6ed886805c89838
-
SHA256
29897313c5509cbaf181e74f29209100d1ef8dc2d9ac9912baf055ecf53c3c48
-
SHA512
dd4d28ea13838d4c7be9b165a6a2740aa865a256b90e44f6952bf81b07e651b2850870d490fb1d793ce84d72fa70ca950b5a02abf04897298ccb5fddf027a14c
-
SSDEEP
3072:rO86IPZVbf8mMpML3A8XKzd9rpOiG3bwapcDebvVSQXMmdb2fDevpaHzbbr0Z:p6Irb0jQRaxCSaAEPMkAbbE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
ModiLoader Second Stage 18 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 7 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timer.exe"C:\Windows\system32\timer.exe"2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\comctl32.exeC:\Windows\system32\comctl32.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\selling pre-contract.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
28KB
MD5579f62549f9389364bdc9e7dcba5021c
SHA163874f4d93757d06ed6d836c01f602d8ea18884d
SHA256cc40e68e243e6ca29213a12100b96970a91ecda7f71c96d7b9b2bfbf67192c8b
SHA512df586884bcc0103752907f79ca3c06df4efe8d05165fa68660b869d30e728eb33592b6d81eacdf6d7fecd9f967ae9151972376d5dea4539aefa4d61874b9767e
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
Filesize
1KB
MD53cbfb8bf6ae3a34e7c8019a0a2781d0a
SHA1904b552996e1ef72cc3d00f83f6efe17246a3793
SHA256f946b60802080ddca7814592a2b23647b440ef01759843e5d876305d6962e87c
SHA5125467d2d3d29b2150338d2ff7c982a12faa171ea446cda43e73808c9753d190a0ff36a1f2369bc64aaaa057e4669f313f68e17d3acfde9873158f1db7b851688a
-
Filesize
22KB
MD59c7e74c1bc61821e6f30b72a605a33d4
SHA19079f466dcb6f1709a673e0a4366f12b9d459346
SHA2568672c1759c07240a3059ec8f532100742d0efbf2cff9525195b5ba4e872bfbac
SHA5125ce4bcc434a24554da2d57806d5d11e55f1dd2866c670e5d27b1066456f0acc36651ab83b2536791c422bec0525f2437dae757b2c68b72652d0ba2dcfdbdb466
-
Filesize
212KB
MD5bc8f48263f7be653d411fa581acdbfee
SHA13b8d476b198f68944abafd6abad9b6fadd67f795
SHA256c5ac33b71ce991bf856b2425ae08329d8bb597d288af1fa9dd125a16dde9614b
SHA5124fa822dac34a5ea04c3626f59e8a2303a54f990735138c565c50dafb65cf1f3643e99caf145e6bd00f1dace2e1bea3d9396b72a9dbc52d2c14b6e24b658f6388
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
280KB